Changelog

The authoritative changelog lives on GitHub: replimap-community — CHANGELOG.md. Version history is also visible on PyPI.

Recent highlights (v0.6.1)

• Air-gapped activation for the Sovereign plan: replimap license machine-id and replimap license activate --file <path> (no network call on the isolated host; see the CLI reference)
• Generated Terraform resource names for load balancers, listeners, target groups, Auto Scaling groups, SQS queues, SNS topics and secrets now come from the resource name instead of the full ARN
• The default VPC, default security groups, main route tables and default subnets are skipped again by codify
• Plan descriptions no longer list features that are not implemented
• Dependency updates clearing known security advisories

Recent highlights (v0.6.0)

New services

• Route53, ACM and CloudFront are scanned, linked in the dependency graph and generated by codify
• ECS clusters and ECR repositories are generated; ECS services and task definitions are graph only
• Secrets Manager and KMS (keys, aliases) are generated, metadata only; SSM parameters are graph only. Secret and parameter values are never read
• Lambda event source mappings and DynamoDB tables are generated; Lambda functions and API Gateway APIs are graph only
• --types accepts the new service names (see the CLI reference)

codify behavior

• Resources owned by a CloudFormation stack are skipped by default; use --include-cfn-managed to generate them
• user_data is left to AWS with lifecycle { ignore_changes } instead of being rendered as a redacted placeholder
• Many fixes that bring the first terraform plan closer to imports only (tags, security group rules, target groups, alarms, launch templates, Auto Scaling groups)

Recent highlights (v0.5.x)

CLI narrowing

• 8 rarely-used commands removed (cost, trends, transfer, unused, dr, snapshot, clone, decisions) — the maintained surface is now the ~23 commands a contractor actually uses on a brownfield adoption engagement. codify remains the path for turning an existing account into Terraform.
• Terraform is now the only codify output format — CloudFormation and Pulumi rendering (previously only reachable through the now-removed clone command) are gone

Aurora support

• scan/codify model Aurora clusters as aws_rds_cluster / aws_rds_cluster_instance instead of dropping cluster members into generic aws_db_instance blocks with attributes that don't apply
• drift's Terraform-state parser recognizes both new types

Trust & licensing

• Ed25519-signed license blobs — the CLI cryptographically verifies its entitlements offline; no phone-home in the scan path
• Outbound-surface cleanup: every dead code path that contacted an external host was deleted from the package

IaC Coverage

• replimap codify --coverage-state matches live resources against one or more Terraform state files (local or s3://) and triages what's unmanaged: real ClickOps vs embedded vs auto-created
• Representation normalization (legacy aws_alb_* aliases, SQS URL vs name, ASG ARN vs name) so the counts hold up on real accounts

Reliability

• Per-item retry in parallel scanning — a transient AWS error can no longer silently drop a resource from the scan; dropped items are reported in the scan summary and the cache is marked partial
• A failed scan can no longer overwrite a good graph cache

Graph

• The interactive dependency graph is a single self-contained HTML file: D3 inlined, zero CDN, renders fully air-gapped
• Hierarchical VPC/subnet containers with viewport-aware fit and a collapsible filter panel